Sigma Converter
Paste a Sigma rule or pick one from SigmaHQ and get Splunk SPL, Microsoft Sentinel KQL, Elastic Lucene and Athena or CloudTrail Lake SQL side by side. Every place a backend cannot say exactly what the rule says is named.
What each backend can express
| Sigma feature | Splunk SPL | Sentinel KQL | Elastic Lucene | Athena SQL |
|---|---|---|---|---|
| contains, startswith, endswith, wildcards | Yes | Yes | Yes | Yes (LIKE) |
| ? single-character wildcard | Becomes * | Yes (regex) | Yes | Yes (_) |
| |re regular expression | Top level only | Yes (RE2) | Limited syntax | Yes |
| |cased | No | Yes (_cs) | Mapping-dependent | Yes |
| |cidr | Yes | Yes | Yes (ip fields) | Yes |
| |fieldref | Top level only | Yes | No | Yes |
| Keyword (full-text) lists | Yes | Term match (has) | Yes | No |
| N of selection (N above 1) | Broadened to OR | Broadened to OR | Broadened to OR | Broadened to OR |
Sigma converter FAQ
How does this compare with pySigma and sigma-cli?
pySigma is the reference converter, with many backends and processing pipelines. This page covers four common targets in the browser for quick conversion and review, and names every place where a backend cannot express the rule exactly. For CI, use sigma-cli with the pipeline for your field names.
Are field names mapped?
For Microsoft Sentinel, CloudTrail fields are mapped to the AWSCloudTrail table and Windows process creation fields to Defender XDR DeviceProcessEvents. Other sources keep the rule's field names, and the output says so. SPL, Lucene and SQL keep the rule's field names.
Why is a backend marked as unable to convert?
Some Sigma features have no equivalent. Lucene cannot compare two fields, SQL has no full-text keyword search, and SPL cannot put a regex inside an OR in a single search. The page refuses rather than writing a query that means something different.
Is case sensitivity preserved?
Sigma matches case-insensitively by default. KQL uses =~, contains and in~, SQL lowercases both sides, and SPL search is case-insensitive already. Elastic keyword fields are case-sensitive unless the index normalises them, so the Lucene output carries a note.
Conversions follow the default query shape of the pySigma backends for each target, without vendor processing pipelines beyond the two Sentinel table maps. Check the output against your own schema before you schedule it. SigmaHQ rules are fetched live under the Detection Rule License 1.1.